Skip to content

Commit 3ae3e55

Browse files
sirantdsirantd
authored
Merge pull request #4 from Perun-Engineering/feat/registry-database
feat: Add registry database
2 parents 2feea63 + f1b2f5d commit 3ae3e55

6 files changed

Lines changed: 121 additions & 36 deletions

File tree

‎.releaserc.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"branches": ["main", "master"],
3+
"ci": false,
4+
"plugins": [
5+
[
6+
"@semantic-release/commit-analyzer",
7+
{
8+
"preset": "conventionalcommits"
9+
}
10+
],
11+
[
12+
"@semantic-release/release-notes-generator",
13+
{
14+
"preset": "conventionalcommits"
15+
}
16+
],
17+
[
18+
"@semantic-release/github",
19+
{
20+
"successComment": "This ${issue.pull_request ? 'PR is included' : 'issue has been resolved'} in version ${nextRelease.version} :tada:",
21+
"labels": false,
22+
"releasedLabels": false
23+
}
24+
],
25+
[
26+
"@semantic-release/changelog",
27+
{
28+
"changelogFile": "CHANGELOG.md",
29+
"changelogTitle": "# Changelog\n\nAll notable changes to this project will be documented in this file."
30+
}
31+
],
32+
[
33+
"@semantic-release/git",
34+
{
35+
"assets": ["CHANGELOG.md"],
36+
"message": "chore(release): version ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
37+
}
38+
]
39+
]
40+
}

‎README.md‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ In the above diagram, you can see the components and their relations (PostgreSQL
2828
|------|---------|
2929
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.36.0 |
3030
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.11.0 |
31-
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.38.0 |
31+
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 3.0.1 |
3232

3333
## Modules
3434

@@ -42,14 +42,15 @@ In the above diagram, you can see the components and their relations (PostgreSQL
4242
| Name | Type |
4343
|------|------|
4444
| [helm_release.gitlab](https://registry.terraform.io/providers/hashicorp/helm/2.11.0/docs/resources/release) | resource |
45-
| [kubernetes_namespace.gitlab](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
46-
| [kubernetes_secret.gitlab_omniauth_providers](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
47-
| [kubernetes_secret.gitlab_rails_storage](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
48-
| [kubernetes_secret.gitlab_registry_storage](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
49-
| [kubernetes_secret.ldap](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
50-
| [kubernetes_secret.postgres](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
51-
| [kubernetes_secret.redis](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
52-
| [kubernetes_secret.smtp](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
45+
| [kubernetes_namespace_v1.gitlab](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace_v1) | resource |
46+
| [kubernetes_secret_v1.gitlab_omniauth_providers](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
47+
| [kubernetes_secret_v1.gitlab_rails_storage](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
48+
| [kubernetes_secret_v1.gitlab_registry_storage](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
49+
| [kubernetes_secret_v1.ldap](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
50+
| [kubernetes_secret_v1.postgres](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
51+
| [kubernetes_secret_v1.redis](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
52+
| [kubernetes_secret_v1.registry_postgres](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
53+
| [kubernetes_secret_v1.smtp](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
5354
| [aws_eks_cluster.eks](https://registry.terraform.io/providers/hashicorp/aws/5.36.0/docs/data-sources/eks_cluster) | data source |
5455
| [aws_iam_policy_document.s3_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/5.36.0/docs/data-sources/iam_policy_document) | data source |
5556
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/5.36.0/docs/data-sources/region) | data source |
@@ -67,6 +68,7 @@ In the above diagram, you can see the components and their relations (PostgreSQL
6768
| <a name="input_namespace_labels"></a> [namespace\_labels](#input\_namespace\_labels) | Labels for GitLab namespace | `map(string)` | `{}` | no |
6869
| <a name="input_omniauth_providers"></a> [omniauth\_providers](#input\_omniauth\_providers) | OmniAuth providers | `map(string)` | `{}` | no |
6970
| <a name="input_redis_password"></a> [redis\_password](#input\_redis\_password) | Password to access Redis database | `string` | n/a | yes |
71+
| <a name="input_registry_database_password"></a> [registry\_database\_password](#input\_registry\_database\_password) | Password to access Registry PostgreSQL database | `string` | `null` | no |
7072
| <a name="input_release_max_history"></a> [release\_max\_history](#input\_release\_max\_history) | Maximum saved revisions per release | `number` | `10` | no |
7173
| <a name="input_release_name"></a> [release\_name](#input\_release\_name) | This is the name of the release which also used as a prefix or suffix for the resources | `string` | `"gitlab"` | no |
7274
| <a name="input_release_namespace"></a> [release\_namespace](#input\_release\_namespace) | Namespace name where you want to deploy the release. If empty, `release_name` will be used. | `string` | `""` | no |

‎examples/main.tf‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,11 @@ module "gitlab" {
2424
release_name = "gitlab"
2525
gitlab_chart_version = "7.8.1"
2626

27-
database_password = "database_password"
28-
redis_password = "redis_password"
29-
smtp_user = "postfix"
30-
smtp_password = "smtp_password"
27+
database_password = "database_password"
28+
registry_database_password = "registry_datatabase_password"
29+
redis_password = "redis_password"
30+
smtp_user = "postfix"
31+
smtp_password = "smtp_password"
3132
omniauth_providers = {
3233
"gitlab-omniauth-saml" = local.saml_google_provider
3334
}
@@ -67,15 +68,16 @@ EOF
6768

6869
values = [
6970
templatefile("values.yaml", {
70-
database_host = "gitlab.xxxxxxxxxxxx.eu-central-1.rds.amazonaws.com"
71-
database_port = "5432"
72-
database_username = "postgres"
73-
redis_host = "master.gitlab.xxxxxx.euc1.cache.amazonaws.com"
74-
redis_port = "6379"
75-
release_name = "gitlab"
76-
bucket_prefix = local.bucket_prefix
77-
domain = "example.com"
78-
smtp_address = "smtp.gmail.com"
71+
database_host = "gitlab.xxxxxxxxxxxx.eu-central-1.rds.amazonaws.com"
72+
database_port = "5432"
73+
database_username = "postgres"
74+
registry_database_username = "gitlab_registry"
75+
redis_host = "master.gitlab.xxxxxx.euc1.cache.amazonaws.com"
76+
redis_port = "6379"
77+
release_name = "gitlab"
78+
bucket_prefix = local.bucket_prefix
79+
domain = "example.com"
80+
smtp_address = "smtp.gmail.com"
7981
})
8082
]
8183

‎examples/values.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,12 @@ global:
2929
username: ${database_username}
3030
database: gitlab
3131

32+
33+
# Mainly for backups, https://docs.gitlab.com/charts/charts/registry/#installation-parameters, https://gitlab.com/gitlab-org/charts/gitlab/-/issues/1464
34+
# https://gitlab.com/gitlab-org/gitlab/-/issues/532507
35+
registry:
36+
bucket: ${bucket_prefix}-registry
37+
3238
redis:
3339
host: ${redis_host}
3440
port: ${redis_port}
@@ -195,6 +201,16 @@ registry:
195201
storage:
196202
secret: ${release_name}-registry-storage
197203
key: config
204+
database:
205+
enabled: true
206+
sslmode: require
207+
host: ${database_host}
208+
port: ${database_port}
209+
user: ${registry_database_username}
210+
name: gitlab_registry # if empty, defaults to `registry`
211+
password:
212+
secret: gitlab-registry-postgresql-password
213+
key: registry-postgresql-password
198214
redis:
199215
cache:
200216
password:

‎main.tf‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,14 @@ locals {
44

55
data "aws_region" "current" {}
66

7-
resource "kubernetes_namespace" "gitlab" {
7+
resource "kubernetes_namespace_v1" "gitlab" {
88
metadata {
99
name = local.release_namespace
1010
labels = var.namespace_labels
1111
}
1212
}
1313

14-
resource "kubernetes_secret" "postgres" {
14+
resource "kubernetes_secret_v1" "postgres" {
1515
metadata {
1616
name = "${var.release_name}-postgresql-password"
1717
namespace = local.release_namespace
@@ -27,7 +27,25 @@ resource "kubernetes_secret" "postgres" {
2727
type = "Opaque"
2828
}
2929

30-
resource "kubernetes_secret" "redis" {
30+
resource "kubernetes_secret_v1" "registry_postgres" {
31+
# Optional, at this moment S3-only can be used https://docs.gitlab.com/administration/packages/container_registry_metadata_database/
32+
count = var.registry_database_password != null ? 1 : 0
33+
metadata {
34+
name = "${var.release_name}-registry-postgresql-password"
35+
namespace = local.release_namespace
36+
}
37+
38+
data = {
39+
registry-postgresql-password = var.registry_database_password
40+
#We need below if we are going to deploy PostgreSQL next to the Gitlab in the EKS
41+
#not as RDS for PostgreSQL
42+
registry-postgresql-postgres-password = var.registry_database_password
43+
}
44+
45+
type = "Opaque"
46+
}
47+
48+
resource "kubernetes_secret_v1" "redis" {
3149
metadata {
3250
name = "${var.release_name}-redis-password"
3351
namespace = local.release_namespace
@@ -40,7 +58,7 @@ resource "kubernetes_secret" "redis" {
4058
type = "Opaque"
4159
}
4260

43-
resource "kubernetes_secret" "smtp" {
61+
resource "kubernetes_secret_v1" "smtp" {
4462
#count = local.values.global.smtp.authentication == "false" ? 0 : 1
4563

4664
metadata {
@@ -55,7 +73,7 @@ resource "kubernetes_secret" "smtp" {
5573
type = "Opaque"
5674
}
5775

58-
resource "kubernetes_secret" "gitlab_rails_storage" {
76+
resource "kubernetes_secret_v1" "gitlab_rails_storage" {
5977
metadata {
6078
name = "${var.release_name}-rails-storage"
6179
namespace = local.release_namespace
@@ -64,20 +82,20 @@ resource "kubernetes_secret" "gitlab_rails_storage" {
6482
data = {
6583
connection = <<EOF
6684
provider: AWS
67-
region: ${data.aws_region.current.name}
85+
region: ${data.aws_region.current.id}
6886
use_iam_profile: true
6987
EOF
7088
config = <<EOF
7189
[default]
72-
bucket_location = ${data.aws_region.current.name}
90+
bucket_location = ${data.aws_region.current.id}
7391
multipart_chunk_size_mb = 128
7492
EOF
7593
}
7694

7795
type = "Opaque"
7896
}
7997

80-
resource "kubernetes_secret" "gitlab_omniauth_providers" {
98+
resource "kubernetes_secret_v1" "gitlab_omniauth_providers" {
8199
for_each = local.omniauth_providers
82100
metadata {
83101
name = each.value
@@ -91,7 +109,7 @@ resource "kubernetes_secret" "gitlab_omniauth_providers" {
91109
type = "Opaque"
92110
}
93111

94-
resource "kubernetes_secret" "ldap" {
112+
resource "kubernetes_secret_v1" "ldap" {
95113
count = lookup(local.values.global.appConfig, "ldap", []) == [] ? 0 : 1
96114
metadata {
97115
name = "${var.release_name}-ldap-password"
@@ -105,7 +123,7 @@ resource "kubernetes_secret" "ldap" {
105123
type = "Opaque"
106124
}
107125

108-
resource "kubernetes_secret" "gitlab_registry_storage" {
126+
resource "kubernetes_secret_v1" "gitlab_registry_storage" {
109127
metadata {
110128
name = "${var.release_name}-registry-storage"
111129
namespace = local.release_namespace
@@ -115,7 +133,7 @@ resource "kubernetes_secret" "gitlab_registry_storage" {
115133
config = <<EOF
116134
s3:
117135
bucket: ${var.bucket_prefix}-registry
118-
region: ${data.aws_region.current.name}
136+
region: ${data.aws_region.current.id}
119137
v4auth: true
120138
EOF
121139
}
@@ -251,9 +269,9 @@ resource "helm_release" "gitlab" {
251269
}
252270

253271
depends_on = [
254-
kubernetes_secret.postgres,
255-
kubernetes_secret.redis,
256-
kubernetes_secret.gitlab_rails_storage,
272+
kubernetes_secret_v1.postgres,
273+
kubernetes_secret_v1.redis,
274+
kubernetes_secret_v1.gitlab_rails_storage,
257275
module.gitlab_role
258276
]
259277
}

‎variables.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,13 @@ variable "database_password" {
3939
sensitive = true
4040
}
4141

42+
variable "registry_database_password" {
43+
type = string
44+
description = "Password to access Registry PostgreSQL database"
45+
sensitive = true
46+
default = null
47+
}
48+
4249
variable "redis_password" {
4350
type = string
4451
description = "Password to access Redis database"

0 commit comments

Comments
 (0)